URLhaus: rat Malicious URLs

Hunt Hypothesis

This rule identifies known malicious URLs associated with the RAT (Remote Access Trojan) family, indicating potential compromise through web-based initial access or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage intrusions and prevent lateral movement before attackers establish persistent control over endpoints.

IOC Summary

Threat: rat Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["web.opendrive.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["web.opendrive.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications or API gateways (e.g., custom Java/.NET services) may use hardcoded, non-standard URL patterns for internal health probes or cache validation that accidentally match the regex for “rat” (e.g., https://internal-app.corp.com/status/rate-limit-check).

  • Filter/Exclusion: Exclude URLs containing specific internal path segments like /health, /status, or /api/v1/ from the detection logic, or whitelist known internal domains (e.g., *.corp.com, *.internal.local) if the regex is overly broad.

• CI/CD Pipeline Artifact Retrieval: Build agents (e.g., Jenkins, Azure DevOps, GitHub Actions) frequently fetch build artifacts or dependency packages from internal artifact repositories (e.g., Nexus, Artifactory, PyPI mirrors). If the artifact name or path contains the substring “rat” (e.g., lib-rat-utils-2.1.jar or node_modules/rat-parser), the URL may trigger the rule.

  • Filter/Exclusion: Exclude URLs originating from known CI/CD service accounts or internal artifact repository domains (e.g., nexus.corp.com, artifactory.internal). Additionally, exclude URLs ending in common build artifact extensions (.jar, .zip, .tar.gz, .whl) if the “rat” match occurs in the filename portion.

• Scheduled Data Sync Jobs: ETL (Extract, Transform, Load) processes or database replication agents (e.g., SQL Server Replication, Kafka Connect, Airflow tasks) may pull data from internal staging servers or data lakes. If the dataset name, partition key, or query parameter contains “rat” (e.g., ?dataset=quarterly-ratios or path=/data/rat-logs-2024), the URL